Diana's focus on personal data protection

Protecting personal data remained a key priority throughout 2025. We recognize that the responsible management of personal information is essential to maintaining the trust of our employees, seafarers and other stakeholders. Our approach is based on transparency, accountability and respect for individual privacy rights, supported by appropriate governance and security measures.

We strengthened our privacy governance framework through the appointment of a Data Protection Officer (DPO) and the update of our Data Protection Policy. The DPO provides guidance on data protection matters, facilitates data protection impact assessments, and serves as a point of contact for supervisory authorities and data subjects. We also continue to ensure that personal data are collected, processed, stored, and protected in accordance with the General Data Protection Regulation (GDPR), applicable data protection laws, and our internal policies and procedures.

Transparency and respect for individual rights are central to our approach. We aim to ensure that employees understand the methods and reasons behind their personal data being stored, as well as the way in which they could exercise their rights in relation to that information. Where applicable under the GDPR, these include rights relating to access, correction, deletion, restriction of processing, data portability and objection. These principles are reflected in our publicly available Privacy Notice, which provides information on data processing, its purpose and legal grounds and the rights available to individuals.

Our commitment to personal data protection is also embedded in our broader culture of ethical conduct. Diana’s Code of Ethics emphasizes the confidentiality of personal information and the responsibility of employees to protect non-public personal data and prevent its unauthorized disclosure. To reinforce this, we continue to deliver employee awareness programs designed to promote responsible data handling and help employees understand both how their own personal data is protected, and their responsibilities when handling the personal information of others.

Furthermore, the protection of personal data also extends to our relationships with third parties. Where appropriate, we enter into data processing agreements with service providers and incorporate data protection provisions into our contractual agreements to help ensure that personal data are processed securely and in accordance with applicable requirements.

During 2025, personal data protection was further supported by our ongoing commitment to fortify our information security framework and the implementation of internationally recognized controls. We maintained our ISO 27001 certification, continued to invest in security controls and monitored capabilities designed to protect information, including personal data, against unauthorized access, loss, destruction or damage. Additionally, as part of our third-party risk management activities, a penetration test was conducted on a critical ERP vendor to further assess and strengthen the security of our digital environment.

Through strong privacy governance, transparency, respect for individual rights, employee awareness, responsible third-party management and information security controls, we focus on protecting personal data throughout its lifecycle and on fostering a culture in which privacy and responsible personal data handling are a shared responsibility.